Man Yue Mo

Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) issue in the `GroupEventJsonView` endpoint. An Insecure Direct Object Reference occurs when an application uses user-supplied input to directly access objects, potentially allowing unauthorized access to data.

Name of the Vulnerable Software and Affected Versions: Apache Doris versions prior to 2.1.8 Apache Doris versions prior to 3.0.3 Description: The issue allows application administrators to read arbitrary files from the server filesystem through path traversal, which is a type of vulnerability known as Improper Limitation of a Pathname to a Restricted Directory. This can be exploited through the REST API. Recommendations: For Apache Doris versions prior to 2.1.8, upgrade to version 2.1.8 or later to fix the issue. For Apache Doris versions prior to 3.0.3, upgrade to version 3.0.3 or later to fix the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.

The issue is related to object corruption in WebAssembly, which could allow a remote attacker to potentially exploit object corruption via a crafted HTML page. This is due to a buffer overflow in memory. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to object corruption in the V8 JavaScript engine used by Google Chrome and Microsoft Edge browsers. It involves a memory corruption vulnerability that can be exploited by a remote attacker through a specially crafted HTML page, potentially allowing the execution of arbitrary code. The severity of this issue is considered high.

The issue is related to a type confusion in the V8 JavaScript engine, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This can lead to arbitrary code execution. The Chromium security severity of this issue is High.

The issue is related to a type confusion vulnerability in the V8 engine of Google Chrome, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability can lead to remote code execution. The Chromium security severity of this issue is High.

The issue is related to type confusion in the V8 JavaScript engine of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue by using a specially crafted HTML page, allowing them to execute arbitrary code. The severity of this issue is considered high.

The issue is related to the mishandling of GPU memory operations, allowing unprivileged users to access freed memory. This can lead to a denial of service. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. The vulnerability is related to the use of memory after it has been freed, which can be exploited by a remote attacker.

The issue is related to a type confusion error in the V8 JavaScript engine of Google Chrome, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This could potentially lead to the disclosure of protected information.

The issue is related to a type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing them to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon (affected versions not specified) Description: The issue is related to improper validation of kernel buffer address while copying information back to user buffer, which can lead to kernel memory information exposure to user space. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Qualcomm npu driver (affected versions not specified) Description: The issue is related to improper validation of kernel buffer address while copying information back to user buffer, which can lead to kernel memory information exposure to user space. This affects various Snapdragon products, including Auto, Compute, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon (affected versions not specified) Description: The issue arises from improper handling of responses from firmware, potentially leading to use after free. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a use after free vulnerability in the WebAuthentication component of Google Chrome. This could allow a remote attacker who has compromised the renderer process of a user, particularly one who has saved a credit card in their Google account, to potentially exploit heap corruption via a crafted HTML page.

The issue is related to type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can exploit this by using a specially crafted HTML page, potentially gaining access to sensitive data, disrupting data integrity, and causing a denial of service.

The issue is related to a use after free in the audio component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information.

The issue is related to a use after free in the payments component of Google Chrome, which could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape. This can be achieved via a crafted HTML page. The attacker may be able to execute arbitrary code.

The issue is related to a use after free in the payments component of Google Chrome, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could enable the attacker to bypass existing security restrictions.

The issue is related to a use after free in the WebAudio component, which can be exploited by a remote attacker via a crafted HTML page. This could potentially lead to heap corruption, allowing the attacker to gain unauthorized access to sensitive data, cause a denial of service, or impact data integrity.

The issue is related to a use after free error in the audio component of Google Chrome, which can be exploited by a remote attacker to potentially access sensitive data, compromise data integrity, and cause a denial of service. This can be achieved via a crafted HTML page, allowing for heap corruption.